CVE-2026-73308

5.7 Moyenne

Publiée le 12/08/2026 à 22:17 · Modifiée le 08/09/2026 à 22:56 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.

Traduire en français

Produits concernés

budibase

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.7 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-200

Références

https://github.com/Budibase/budibase/commit/bca426de7dc36d680285295655dc640dea2aab21
https://github.com/Budibase/budibase/pull/19107
https://github.com/Budibase/budibase/releases/tag/3.39.25
https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7
https://github.com/Budibase/budibase/security/advisories/GHSA-gh4h-34gr-87r7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories